STATE OF NORTH CAROLINA 


SEARCH WARRANT 


IM THE MATTER OF 


WAKE 


County 


In The General Court Of Justice 
District/Superior Court Division 


Google, Inc. 

Date Issued 

_ 01/28/2019 

Name Of Applicant 

Det A. Olliver II 

Name Of Additional Affiant 


Name Of Additional Affiant 


Time issued 


□ AM 


- RETURN OF SERVICE || -r . 

I certify that this Search Warrant was received and 
executed as follows; 


Date Received 


U 2% i ‘I 

Date Executed 

USiU 3^1 ^ 


Time Received 


□ AM 


To any officer with authority and jurisdiction to conduct the search authorized by this Search Warrant: 

1, the undersigned, find that there is probable cause to believe that the property and person described in the 
application on the reverse side and related to the commission of a crime is located as described in the 
application. 

You are commanded to search the premises, vehicle, person and other place or item described in the 
application for the property and person in question. If the property and/or person are found, make the 
seizure and keep the property subject to Court Order and process the person according to law. 

You are directed to execute this Search Warrant within forty-eight (48) hours from the time indicated on this 
Warrant and make due return to the Clerk of the Issuing Court. 

This Search Warrant is issued upon information furnished under oath or affirmation by the person(s) shown. 


Time Executed 


cl f ao □ AM [^TM 


□ I made a search of, 




_as commanded. 

□ I seized the items listed on the attached 
inyentory. 

Q-ldid not seize any items. 

□ This Warrant WAS NOT executed within 
forty-eight (48) hours of the date and time of 
issuance and I hereby return it not executed. 


Name OfQpcer Making Return (t^ge or print) 


I I Deputy CSC Q Assistant CSC CSC Q Magistrate Q District Ct. Judge Superior CL Judge 


NOTE: When issuing a search warrant, the issuing officiai must retain a copy of the warrant and warrant appiication 
and must promptly file them with the clerk. G.S. 15A-245(b). 


This Search Warrant was delivered to me on the date and at the time shown below when the Office of the 
Clerk of Superior Court is closed for the transaction of business. By signing below, I certify that I will deliver 
this Search Warrant to the Office of the Clerk of Superior Court as soon as possible on the Clerk’s next 
business day. 


Signature Of Magistrate 



This Search Warrant was returned to the undersigned clerk on the date and time shown below. 


Of Cierk (type or print) / 











AOC-CR-119, Rev. 3/17 
© 2017 Administrative Office of the Courts 


Original - File Copy - For Search of a Person, to Person from Whom Items Taken 
Copy - For Search of Vehicle/Premises, to Owner or Person in Apparent Control; if No Such Person Present. Leave Copy Affixed Thereon 

(Over) 




















STATE OF NORTH CAROLINA 

IN THE GENERAL COURT OF JUSTICE 

WAKE COUNTY 

DISTRICT COURT DIVISION 

IN THE MATTER OF: 

Google Inc 

DETECTIVE: Andrade Olliver II 

DATE: January 28, 2019 


APPLICATION FOR SEARCH WARRANT 
AFFIDAVIT 


Property/Person To Be Searched: 


This warrant is directed to Google, Inc. (the "Provider"), headquartered at 1600 Amphitheatre 
Parkway, Mountain View, California 94043, and applies to all content and other information within 
the Provider's possession, custody, or control associated with the any device that was located 
in the Latitude and Longitude 35.593229, -78.765133133, on 1/25/2019 between 0100 hours 
and 0400 hours and Maintained at the Premises Controlled by Google, Inc. 

A law enforcement officer will serve this warrant by transmitting it via email or another appropriate 
manner to the Provider. The Provider is directed to produce to the law enforcement officer an 
electronic copy of the information specified in ATTACHMENT I. 

Upon receipt of the production, law enforcement personnel (who may include, in addition to law 
enforcement officers and agents, attorneys for the government, attorney support staff, agency 
personnel assisting the government in this investigation, and outside technical experts under 
government control) are authorized to review the records produced by the Provider in order to 
locate any evidence, fruits, and instrumentalities of violations of North Carolina General Statute 
14-54(A), Burglary/Breaking & Entering, which may be contained within the furnished records. 


Section I: Affiant Information 


The Affiant swears to the following facts to establish probable cause for the issuance of a 
search warrant: 

This affiant swears to the following facts establishing probable cause for the issuance of a 
search warrant. Affiant has been a sworn Law Enforcement Officer for over four years and is 
currently an Investigator for The Town of Fuquay-Varina Police Dept. During the course of 
employment as a Law Enforcement Officer, this applicant has received more than 1,290 hours 
of in-service training pertaining to functions of law enforcement duties including such courses as 
Digital Evidence Expertise in The Courtroom, Fundamentals of Fingerprint Evidence, Intro to 
Wireless Investigations, Intro to Cybercrimes, Credit Card Fraud & Digital Evidence, Digital 
Search & Seizure for Patrol Officers, Internet Investigations, Best Practices for Seizing Digital 
Evidence, Investigation of Social Networking Sites, Intro to lED’S & Forensic Evidence, Gunshot 
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Wounds and Forensic Evidence .Automotive Digital Evidence & Theft .Advanced Identity Theft 
& Electronic Crimes .Cell Phone Investigation & Electronic Evidence . Understanding the value 
of trace evidence. Investigation of Strangulation & Forensic Evidence. Drones for Law 
Enforcement. Basic Crime Scene Investigation For First Responders, Wound Injuries, Patterns 
& Analysis, Crime Scene Photography - Part 1, Crime Scene Photography - Part 2, Crime 
Scene Photography - Part 3, Introduction to GPS Evidence for Law Enforcement, Cell Phone 
Investigation & Electronic Evidence, Introduction to Computer Forensics, Introduction to DNA for 
Law Enforcement, Investigation of Smart Phones & Applications, DWl Detection, Basic Narcotic 
Investigation, Prescription Drug Crimes , Burglary and Property Crime Scene Investigation, 

Drug Enforcement for Patrol Officers, Crisis Intervention Team. 

The training was received through Continuing Education and In-Service Training Classes at 
Wake Technical Community College in Raleigh, NC, the Coastal Plains Law Enforcement 
Training Center located in Wilson, NC, and Johnston County Community College in Smithfield, 
NC, Central Piedmont Community College in Matthews, NC and Guilford Technical Community 
College in Jamestown, NC. I additionally hold an Intermediate Law Enforcement Certificate 
issued by the North Carolina Criminal Justice Training Standards Commission, as well as a 
bachelor s Degree in Criminal Justice. I have, during my law enforcement tenure, been involved 
in and made numerous arrests resulting from criminal investigations. I have testified in North 
Carolina State Court and have obtained successful convictions following criminal investigations 
in which I participated. 


Section II: Crime Under Investigation and Property to be Seized: Burglary/Breaking & Entering 14- 
54(A) Any content and other information associated with the Latitude and Longitude 
35.593229, -78765133133 on 1/25/2019 between 0100 hours and 0400 hours maintained at 
premises controlled by Google Inc 


Section III: Facts Establishing Probable Cause 


The information received during the course of this investigation is discussed in this affidavit and 
is believed to be true and accurate by Det A. Olliver II. 

On Friday 01/25/2019, at approximately 0630 hours. Officer Plante responded to 610 Lakestone 
Commons Ave (Kiddie Academy) in reference to a breaking and entering. 

Upon his arrival, he met with employees that were already inside the building. Rebecca 
Dickinson (Other Involved #1) stated she was the one that found the broken window but was the 
second employee to show up for work. Jennifer Stephens (Other Involved #2) was the first to 
show up but did not notice the broken window. Officer Plante asked Dickinson if they noticed 
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anything missing and she replied they already walked through the daycare and did not find 
anything missing. Sgt. Coor and Officer Plante were escorted to every room to double check for 
a suspect, missing items or further evidence, but nothing was located. Officer Plante asked 
Dickinson if there were security cameras to which she stated there are some inside the daycare, 
but only Michele Carter (Other Involved #3) and Brian Dorr (Owner/Other Involved #4) can 
access them. 


Once Carter and Dorr arrived, Officer Plante requested access to the video surveillance. There 
is one camera in every room, the lobby and multiple ones located outside. 

Using the surveillance footage, on 01/25/2018 at 0258 hours a vehicle is seen driving from 
behind Big Lots very slowly, drives towards Kiddie Academy and then driving along the left side 
of the building going towards bakestone Commons Ave. The vehicle then turns left onto 
bakestone Commons Ave. 

On 01/25/2019 at 0311 hours a subject is seen walking on bakestone Commons Ave going 
towards US 401 and turns right onto the alley street running along the side of Kiddie Academy. 
At 0316 hours, using the internal camera on the room of entry, the subject is seen smashing the 
window and making entry into the daycare. The subject then walks into the lobby where lights 
turn on, and he turns right into the main office. The subject is seen opening a drawer and then 
goes out of view. From that room, the subject goes across the hall into the other lobby front 
room where no activity can be observed as the subject walks out of the room and heads 
towards where he entered and looked up at the camera. The subject is a black male, wearing a 
hooded overcoat, a face mask, jeans, and sneakers. After the subject leaves the daycare, he is 
seen at 0322 hours walking back towards bakestone Commons Ave and turning left on 
bakestone Commons Ave heading towards bakestone Village bn. 

On 1/25/2019 I observed on camera the suspect pulls out a small object with a light in what I 
believe to be a cellphone. I also observed the suspect's vehicle was the only vehicle in the area 
at the time of the crime. 

This applicant knows that a cellular telephone or mobile telephone is a handheld wireless device 
primarily used for voice, text, and data communication through radio signals. Cellular 
telephones send signals through networks of transmitter/receivers called “cells” or “cell sites,” 
enabling communication with other cellular telephones or traditional “landline” telephones. 
Cellular telephones rely on cellular towers, the location of which may provide information on the 
location of the subject telephone. Cellular telephones may also include global positioning 
system (“GPS”) or other technology for determining a more precise location of the device. 

In this Investigator’s training and experience, I know that in modern times cellular telephones 
are ubiquitous and used by people of all ages and demographies. The mobile and individualistic 
nature of cellular telephones mean that they are often carried by their users wherever they 
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travel and generally geographically mirror their user’s pattern of movement over time. Further, a 
cellular telephone tends to be used by a specific person over a period of time and so records 


associated with that device reflect the activity and pattern of life of that specific person. Various 
companies, such as cellular telecommunication providers as well as operating system designers 
(Google), are known to maintain records associated with the location of specific cellular devices 
they provide service to. This is done to ensure the continued quality of their service, to enable 
location-based services, and to facilitate normal operation of the cellular device. 

This applicant also knows that Google is a company which, among other things, provides 
electronic communication services to subscribers, including email services. Google allows 
subscribers to obtain email accounts at the domain name gmail.com and/or google.com. 
Subscribers obtain an account by registering with Google. A subscriber using the Provider’s 
services can access his or her email account from any computer/device connected to the 
Internet. 

This applicant knows that Google has also developed a proprietary operating system for mobile 
devices, including cellular phones, known as Android. Nearly every cellular phone using the 
Android operating system has an associated Google account, and users are prompted to add a 
Google account when they first turn on a new Android device. 

Based on this applicant’s training and experience, this applicant knows that Google collects and 
retains location data from Android-enabled mobile devices when a Google account user has 
enabled Google location services. Google can also collect location data from non-Android 
devices if the device is registered to a Google account and the user has location services 
enabled. The company uses this information for location-based advertising and location-based 
search results and stored such data in perpetuity unless it is manually deleted by the user. This 
location information is derived from GPS data, cell site/cell tower information, and Wi-Fi access 
points. 

This applicant knows that location data can assist investigators in forming a fuller geospatial 
understanding and timeline related to a specific criminal investigation; and may tend to identify 
potential witnesses and/or suspects. Such information can also aid investigators in possibly 
inculpating or exculpating persons of interest. 

Additionally, location information can be digitally integrated into image, video, or other computer 
files associated with a Google account and can indicate the geographic location of the accounts 
user at a particular date and time (e g-, digital cameras, including on cellular telephones, 
frequently store GPS coordinates indicating where a photo was taken in the “metadata” of an 
image file). 

In this applicant’s training and exfDerience, I have learned that Google provides a variety of online 
services, including electronic mail (“email”) access, to the public. Google allows subscribers to 
obtain email accounts at the domain name Gmail.com. Subscribers obtain an account by 
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registering with Google. During the registration process, Google asks subscribers to provide basic 
personal information. Therefore, the computers of Google are likely to contain stored electronic 
communications (including retrieved and un-retrieved email for Google subscribers) and 
information concerning subscribers and their use of Google services, such as account access 
information, email transaction information, and account application information. In my training and 
experience, such information may constitute evidence of the crimes under investigation because 
the information can be used to identify the account’s user or users. 

A Google subscriber can also store with the Provider files in addition to emails, such as address 
books, contact or buddy lists, calendar data, pictures (other than ones attached to emails), and 
other files, on servers maintained and/or owned by Google. In my training and experience, 
evidence of who was using an email account may be found in address books, contact or buddy 
lists, email in the account, and attachments to emails, including pictures and files. 

In this applicants training and experience, email providers generally ask their subscribers to 
provide certain personal identifying information when registering for an email account. Such 
information can include the subscriber’s full name, physical address, telephone numbers and 
other identifiers, alternative email addresses, and, for paying subscribers, means and source of 
payment (including any credit or bank account number). In my training and experience, such 
information may constitute evidence of the crimes under investigation because the information 
can be used to identify the account’s user or users. Based on my training and my experience, I 
know that even if subscribers insert false information to conceal their identity, I know that this 
information often provide clues to their identity, location or illicit activities. 

In this applicants training and experience, email providers typically retain certain transactional 
information about the creation and use of each account on their systems. This information can 
include the date on which the account was created, the length of service, records of login (/.e., 
session) times and durations, the types of service utilized, the status of the account (including’ 
whether the account is inactive or closed), the methods used to connect to the account (such as 
logging into the account via the provider’s website), and other log files that reflect usage of the 
account. In addition, email providers often have records of the Internet Protocol address (“IP 
address ) used to register the account and the IP addresses associated with particular logins to 
the account. Because every device that connects to the Internet must use an IP address, IP 
address information can help to identify which computers or other devices were used to access 
the email account. 

In this applicant’s training and experience, in some cases, email account users will 
communicate directly with an email service provider about issues relating to the account, such 
as technical problems, billing inquiries, or complaints from other users. Email providers typically 
retain records about such communications, including records of contacts between the user and 
the providers support services, as well records of any actions taken by the provider or user as a 
result of the communications. In my training and experience, such information may constitute 
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evidence of the crimes under investigation because the information can be used to identify the 
account’s user or users. 


As explained herein, information stored in connection with an email account may provide crucial 
evidence of the “who, what, why, when, where, and how” of the criminal conduct under 
investigation, thus enabling the United States to establish and prove each element or 
alternatively, to exclude the innocent from further suspicion. In my training and experience, the 
information stored in connection with an email account can indicate who has used or controlled 
the account. This “user attribution” evidence is analogous to the search for “indicia of 
occupancy” while executing a search warrant at a residence. For example, email 
communications, contacts lists, and images sent (and the data associated with the foregoing, 
such as date and time) may indicate who used or controlled the account at a relevant time. 
Further, information maintained by the email provider can show how and when the account was 
accessed or used. For example, email providers typically log the IP addresses from which users 
access the email account along with the time and date. By determining the physical location 
associated with the logged IP addresses, investigators can understand the chronological and 
geographic context of the email account access and use relating to the crime under 
investigation. This geographic and timeline information may tend to either inculpate or exculpate 
the account owner. Additionally, information stored at the user’s account may further indicate 
the geographic location of the account user at a particular time {e.g., location information 
integrated into an image or video sent via email). Last, stored electronic data may provide 
relevant insight into the email account owner’s state of mind as it relates to the offense under 
investigation. For example, information in the email account may indicate the owner’s motive 
and intent to commit a crime (e.g., communications relating to the crime), or consciousness of 
guilt (e.g., deleting communications in an effort to conceal them from law enforcement). 

In this applicant’s training and experience, I have also learned that, in addition to e-mail, Google 
provides a variety of online services, including telecommunications access, to the public. 
Subscribers obtain an account by registering with Google. During the registration process, 
Google asks subscribers to provide basic personal information. Therefore, the computers of 
Google are likely to contain stored electronic communications (including retrieved and un¬ 
retrieved voicemails and text messages for Google subscribers) and information concerning 
subscribers and their use of Google services, such as account access information, toll records, 
and account application information. In my training and experience, such information may 
constitute evidence of the crimes under investigation because the information can be used to 
identify the account’s user or users. 

Google Voice is an Internet-based communications service that allows users to control multiple 
phone^ lines or phone accounts through a single Google account. Anyone with a Google account 
may sign up for Google Voice. A single Google account can be used to access all of the online 
services offered by Google, such as Google E-mail, Google Checkout, or Google Talk. Google 
Voice advertises itself as a phone management system. A user is assigned a 10-digit U.S. 
telephone phone number, and that user can then consolidate several phone lines or numbers 
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into that single US phone number. Google Voice works with mobile phones, desk phones, work 
phones, and Voice Over Internet Protocol (VoIP) lines. Incoming phone calls to the Google 
Voice number will then ring simultaneously on all of the user’s configured phones or to the 
account’s Google Talk feature, which is an online video and voice chatting service similar to 
Skype. 

A Google Voice account combines many traditional cell phone services with the features of an 
email or online storage account. For example, a user may receive voicemail at a Google Voice 
number, record calls, transcribe voicemails, and send text or instant messages. Google Voice 
offers the ability to send and receive text messages to an email address or cell phone, and then 
store that data online. Voicemail messages left at a Google Voice number can be converted to 
text format and then emailed or texted to the user account. 

To send a text message, a user logs into a Google Voice account via the Internet, selects the 
Text option in the account, enters the text and phone number of the recipient, and then clicks 
on the “Send” command button. When the subscriber sends an email or text message, it is 
initiated at the user’s computer, transferred via the Internet to Google’s servers, and then 
transmitted to its end destination. Google often saves a copy of the message sent. Because a 
Google Voice account is associated with a general Google account, which has email capability, 
users have access to the traditional features of an email account. Unless the sender of the 
email specifically deletes the email or text, the message can remain on the system indefinitely. 
Permanent storage of all incoming and outgoing data is the default setting for a Google Voice 
account. 

A Google subscriber can also store with the provider files in addition to emails, such as address 
books, contact or buddy lists, pictures, and other files, on servers maintained and/or owned by 
Google. In my training and experience, evidence of who was using a Google Voice account may 
be found in address books, contact or buddy lists, communications in the account, and 
attachments, including pictures and files. 

According to representatives of Google, the company keeps records that can reveal Google 
accounts accessed from the same electronic device, such as the same computer or 
mobile phone, including accounts that are linked by “cookies,” which are small pieces of text 
sent to the user’s Internet browser when visiting websites. This warrant requires Google to 
identify any other accounts accessed by the same device(s) that accessed the Subject Account 
described in Attachment A, including accounts linked by cookies, recovery email address, or 
telephone number. This warrant will ask that Google identify such accounts and produce 
associ ated subscriber information. 

This applicant knows that websites collect User Agent Strings (UAS) of all visitors to a web page 
in order to provide the visitor a version of the website that is properly formatted for their web 
browser. A UAS provides details about the hardware and software the user might be using to 
visit the webpage; such as operating system, web browser version, and occasionally hardware 
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manufacturer of the device used to visit the web page. The production of such details will also 
aid in identifying subjects searching for the terms listed above. 


The applicant would respectfully request the court issue a search warrant for the material outlined 
in ATTACHMENT I of the above-mentioned Google, Inc. or Google Payment Corp. account. 

All information and facts provided in this affidavit are true and accurate to the best of the 
applicant’s knowledge. The applicant feels that there is sufficient probable cause for the 
issuance of a search warrant for the evidence, fruits, and instrumentalities of violations of North 
Carolina General Statute 14-54(A), Burglary/Breaking & Entering which may be contained within 
the furnished records. 
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